Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-08-2013 Ran by SYSTEM on 21-08-2013 10:37:26 Running from F:\ Windows Vista Home Premium (X86) OS Language: English(US) Internet Explorer Version 9 Boot Mode: Recovery
The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [217088 2007-12-21] (Alps Electric Co., Ltd.) HKLM\...\Run: [iAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178712 2007-10-03] (Intel Corporation) HKLM\...\Run: [QlbCtrl] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2007-09-27] ( Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [uCam_Menu] - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2007-09-13] (CyberLink Corp.) HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation) HKLM\...\Run: [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [480560 2007-10-03] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.) HKLM\...\Run: [Net iD] - C:\Program Files\Net iD\iid.exe [99640 2010-02-01] (SecMaker AB) HKLM\...\Run: [ConnecteSupport] - C:\Program Files\Tific\Tific Client G1\ConnecteSupport.exe [2308608 2011-03-29] (Tific) HKLM\...\Run: [Family Tree Builder Update] - C:\MyHeritage\Bin\FTBCheckUpdates.exe [229376 2011-12-21] (MyHeritage) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [947152 2013-01-27] (Microsoft Corporation) HKLM\...\Run: [TkBellExe] - c:\program files\real\realplayer\Update\realsched.exe [295072 2012-12-27] (RealNetworks, Inc.) HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-15] (Samsung Electronics Co., Ltd.) HKLM\...\Winlogon: [userinit] C:\Windows\system32\userinit.exe HKU\Dator\...\Run: [MsnMsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [ 2012-03-08] (Microsoft Corporation) HKU\Dator\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-18] (Microsoft Corporation) HKU\Dator\...\Run: [skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2012-07-13] (Skype Technologies S.A.) HKU\Dator\...\Run: [GameXN GO] - C:\ProgramData\GameXN\GameXNGO.exe [ 2012-03-18] (EasyBits Software AS) HKU\Dator\...\Run: [ilubqyowon] - C:\Users\Dator\AppData\Roaming\Imfo\ygceh.exe [x] HKU\Dator\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-07-15] (Samsung) HKU\Dator\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup [x] HKU\Dator\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-07-15] (Samsung) HKU\Dator\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-18] (Microsoft Corporation) HKU\Dator\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Dator\AppData\Local\Temp\doxnnyqrlofmrotrs.exe [ 2013-08-20] (Valve Corporation) <===== ATTENTION HKU\Dator\...\RunOnce: [shockwave Updater] - C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" -"http://spel.spelo.se/699bbd6eba34f4b3728a65c02cb87c31/game.php?file=687474703a2f2f7370656c2e7370656c6f2e73652f36393962626436656261333466346233373238613635633032636238376333312f313634342e646372&width=100%&height=100%&spelo=1&cr=1&dpl=1&nobtn=1" [x] HKU\Dator\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_202_ActiveX.exe [ 2013-05-14] (Adobe Systems Incorporated) HKU\Dator\...\Winlogon: [shell] cmd.exe [ 2008-01-18] (Microsoft Corporation) <==== ATTENTION HKU\Dator\...\Command Processor: "C:\Users\Dator\AppData\Local\Temp\doxnnyqrlofmrotrs.exe" <===== ATTENTION! HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-10] (Microsoft Corporation) HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-10] (Microsoft Corporation) Startup: C:\Users\Dator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk ShortcutTarget: OpenOffice.org 3.0.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
========================== Services (Whitelisted) =================
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.) S2 CTATSvc; C:\Program Files\Telia\Connect\ATService.exe [582976 2011-06-27] (Telia) S2 CTConnect; C:\Program Files\Telia\Connect\Connect.exe [1899840 2011-06-27] (Columbitech) S2 gupdate1ca0f5a6f8847e0; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-07-28] (Google Inc.) S2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard) S2 Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2152152 2011-10-29] (Lavasoft Limited) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation) S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-13] () S2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] () S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] () S2 sprtsvc_teliada; C:\Program Files\Telia\Supportassistenten\bin\sprtsvc.exe [206120 2010-05-10] (SupportSoft, Inc.) S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-13] (Sony Corporation) S2 SupportSoft RemoteAssist; C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe [382320 2008-10-16] (SupportSoft, Inc.) S2 tgsrvc_teliada; C:\Program Files\Telia\Supportassistenten\bin\tgsrvc.exe [185640 2010-05-10] (SupportSoft, Inc.) S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [x]
==================== Drivers (Whitelisted) ====================
S0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-10] (Microsoft Corporation) S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-10-11] (Conexant Systems Inc.) S3 Lavasoft Kernexplorer; C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys [15232 2011-08-18] () S0 Lbd; C:\Windows\System32\DRIVERS\Lbd.sys [64512 2011-08-18] (Lavasoft AB) S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation) S3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [9728 2007-01-15] (Microsoft Corporation) S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1810992 2009-03-26] () S1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] () S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x] S1 eabfiltr; S3 IpInIp; system32\DRIVERS\ipinip.sys [x] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x] S3 SymIM; system32\DRIVERS\SymIM.sys [x] S3 SymIMMP; system32\DRIVERS\SymIM.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-20 02:39 - 2013-08-20 02:39 - 01038995 _____ C:\Users\Dator\AppData\Roaming\2433f433 2013-08-20 02:39 - 2013-08-20 02:39 - 01038976 _____ C:\ProgramData\2433f433 2013-08-20 02:39 - 2013-08-20 02:39 - 01038961 _____ C:\Users\Dator\Local Settings\Application Data\2433f433 2013-08-20 02:39 - 2013-08-20 02:39 - 01038961 _____ C:\Users\Dator\AppData\Local\2433f433 2013-08-18 03:24 - 2013-08-18 03:24 - 00016091 _____ C:\Users\Dator\Desktop\hs_err_pid6952.log 2013-08-17 22:00 - 2013-08-17 22:00 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{CEEB70B2-5597-42A4-A0CF-BCF9CAA4160F} 2013-08-17 22:00 - 2013-08-17 22:00 - 00000000 ____D C:\Users\Dator\AppData\Local\{CEEB70B2-5597-42A4-A0CF-BCF9CAA4160F} 2013-08-17 05:01 - 2013-08-17 05:02 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{E409EE84-B070-4599-823B-CE07743C08EB} 2013-08-17 05:01 - 2013-08-17 05:02 - 00000000 ____D C:\Users\Dator\AppData\Local\{E409EE84-B070-4599-823B-CE07743C08EB} 2013-08-16 17:01 - 2013-08-16 17:01 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{797D8E19-CB93-4080-A9B4-4F2FB541AAF3} 2013-08-16 17:01 - 2013-08-16 17:01 - 00000000 ____D C:\Users\Dator\AppData\Local\{797D8E19-CB93-4080-A9B4-4F2FB541AAF3} 2013-08-15 17:57 - 2013-08-15 17:57 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{0427F92F-CFF5-4E7B-8D1E-B3728F4AE33B} 2013-08-15 17:57 - 2013-08-15 17:57 - 00000000 ____D C:\Users\Dator\AppData\Local\{0427F92F-CFF5-4E7B-8D1E-B3728F4AE33B} 2013-08-15 17:10 - 2013-07-24 18:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-08-15 17:10 - 2013-07-24 18:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-08-15 17:10 - 2013-07-24 18:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-08-15 17:10 - 2013-07-24 18:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-08-15 17:10 - 2013-07-24 18:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-08-15 17:10 - 2013-07-24 18:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-08-15 17:10 - 2013-07-24 18:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\System32\url.dll 2013-08-15 17:10 - 2013-07-24 18:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-08-15 17:10 - 2013-07-24 18:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-08-15 17:10 - 2013-07-24 18:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-08-15 17:10 - 2013-07-24 18:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-08-15 17:10 - 2013-07-24 18:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-08-15 17:10 - 2013-07-24 18:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-08-15 17:10 - 2013-07-24 18:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-08-15 17:10 - 2013-07-24 18:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-08-15 17:10 - 2013-07-24 18:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-08-14 17:48 - 2013-08-14 17:48 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{71BC6B42-C840-464F-A1DD-FB7FBB648D6B} 2013-08-14 17:48 - 2013-08-14 17:48 - 00000000 ____D C:\Users\Dator\AppData\Local\{71BC6B42-C840-464F-A1DD-FB7FBB648D6B} 2013-08-14 17:16 - 2013-08-14 17:21 - 00000000 ____D C:\Windows\System32\MRT 2013-08-13 23:04 - 2013-07-17 11:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll 2013-08-13 23:04 - 2013-07-10 01:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll 2013-08-13 23:04 - 2013-07-04 19:20 - 00914880 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2013-08-13 23:04 - 2013-07-04 17:43 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpipreg.sys 2013-08-13 23:04 - 2013-06-15 05:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\System32\icaapi.dll 2013-08-13 23:04 - 2013-06-15 03:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys 2013-08-13 23:03 - 2013-07-09 04:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll 2013-08-13 23:03 - 2013-07-07 20:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe 2013-08-13 23:03 - 2013-07-07 20:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2013-08-13 23:03 - 2013-07-07 20:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll 2013-08-13 23:03 - 2013-07-07 20:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll 2013-08-13 23:03 - 2013-07-07 20:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll 2013-08-13 23:03 - 2013-07-07 20:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll 2013-08-05 01:33 - 2013-08-05 01:33 - 00000000 ____T C:\Users\Dator\Documents\10.0.0.2 2013-08-04 21:40 - 2013-08-04 21:40 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{31B6C25D-C2DC-4F87-83A7-30B6B30E67C5} 2013-08-04 21:40 - 2013-08-04 21:40 - 00000000 ____D C:\Users\Dator\AppData\Local\{31B6C25D-C2DC-4F87-83A7-30B6B30E67C5} 2013-08-04 05:57 - 2013-08-04 05:57 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{B6442200-398E-438E-9F6C-C8E760FE8265} 2013-08-04 05:57 - 2013-08-04 05:57 - 00000000 ____D C:\Users\Dator\AppData\Local\{B6442200-398E-438E-9F6C-C8E760FE8265} 2013-07-31 23:05 - 2013-07-31 23:05 - 00000000 ____D C:\Users\Public\Documents\CrashDump 2013-07-31 23:05 - 2013-07-31 23:05 - 00000000 ____D C:\ProgramData\Documents\CrashDump 2013-07-31 23:01 - 2013-07-31 23:01 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log 2013-07-31 23:01 - 2013-07-31 23:01 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\Samsung 2013-07-31 23:01 - 2013-07-31 23:01 - 00000000 ____D C:\Users\Dator\AppData\Local\Samsung 2013-07-31 23:01 - 2013-07-31 23:01 - 00000000 ____D C:\ProgramData\Documents\NativeFus_Log 2013-07-31 22:56 - 2013-07-31 22:56 - 00001783 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk 2013-07-31 22:56 - 2013-07-31 22:56 - 00001783 _____ C:\ProgramData\Desktop\Samsung Kies (Lite).lnk 2013-07-31 22:56 - 2013-07-31 22:56 - 00001773 _____ C:\Users\Public\Desktop\Samsung Kies.lnk 2013-07-31 22:56 - 2013-07-31 22:56 - 00001773 _____ C:\ProgramData\Desktop\Samsung Kies.lnk 2013-07-31 22:56 - 2013-07-31 22:56 - 00000000 ____D C:\Users\Dator\Documents\samsung 2013-07-31 22:51 - 2013-06-20 16:07 - 00153672 _____ (MCCI Corporation) C:\Windows\System32\Drivers\ssadmdm.sys 2013-07-31 22:51 - 2013-06-20 16:07 - 00136904 _____ (MCCI Corporation) C:\Windows\System32\Drivers\ssadbus.sys 2013-07-31 22:51 - 2013-06-20 16:07 - 00017864 _____ (MCCI Corporation) C:\Windows\System32\Drivers\ssadmdfl.sys 2013-07-31 22:51 - 2013-06-20 16:07 - 00015560 _____ (MCCI Corporation) C:\Windows\System32\Drivers\ssadcmnt.sys 2013-07-31 22:51 - 2013-06-20 16:07 - 00015560 _____ (MCCI Corporation) C:\Windows\System32\Drivers\ssadcm.sys 2013-07-31 22:51 - 2013-06-20 16:07 - 00015304 _____ (MCCI Corporation) C:\Windows\System32\Drivers\ssadwhnt.sys 2013-07-31 22:51 - 2013-06-20 16:07 - 00015304 _____ (MCCI Corporation) C:\Windows\System32\Drivers\ssadwh.sys 2013-07-31 22:48 - 2013-07-31 22:48 - 00000000 ____D C:\Program Files\MyFree Codec 2013-07-31 22:34 - 2013-06-14 09:57 - 04659712 _____ (Dmitry Streblechenko) C:\Windows\System32\Redemption.dll 2013-07-31 22:34 - 2013-06-14 09:56 - 00821824 _____ (Devguru Co., Ltd.) C:\Windows\System32\dgderapi.dll 2013-07-31 22:34 - 2013-06-14 09:56 - 00020032 _____ (Devguru Co., Ltd) C:\Windows\System32\Drivers\dgderdrv.sys 2013-07-31 22:29 - 2013-07-31 22:49 - 00000000 ____D C:\ProgramData\Samsung 2013-07-31 21:54 - 2013-07-31 21:54 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{FA69375D-8775-41B6-AE2C-712AE8A9CF81} 2013-07-31 21:54 - 2013-07-31 21:54 - 00000000 ____D C:\Users\Dator\AppData\Local\{FA69375D-8775-41B6-AE2C-712AE8A9CF81} 2013-07-28 00:14 - 2013-07-28 00:14 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{4B06ED7B-0BA6-4491-A8EC-7D712817CDB4} 2013-07-28 00:14 - 2013-07-28 00:14 - 00000000 ____D C:\Users\Dator\AppData\Local\{4B06ED7B-0BA6-4491-A8EC-7D712817CDB4} 2013-07-27 03:40 - 2013-07-27 03:40 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{5209729A-E0B2-4240-9A23-E6A52B97AC9A} 2013-07-27 03:40 - 2013-07-27 03:40 - 00000000 ____D C:\Users\Dator\AppData\Local\{5209729A-E0B2-4240-9A23-E6A52B97AC9A}
==================== One Month Modified Files and Folders =======
2013-08-21 10:33 - 2013-08-21 10:33 - 00000000 ____D C:\FRST 2013-08-20 23:56 - 2006-11-02 04:47 - 00003296 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-20 23:56 - 2006-11-02 04:47 - 00003296 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-20 23:54 - 2006-11-02 04:47 - 00327776 _____ C:\Windows\System32\FNTCACHE.DAT 2013-08-20 23:52 - 2008-04-15 20:01 - 01381120 _____ C:\Windows\WindowsUpdate.log 2013-08-20 23:31 - 2011-09-21 03:42 - 00000064 _____ C:\Windows\System32\rp_stats.dat 2013-08-20 23:31 - 2011-09-21 03:42 - 00000044 _____ C:\Windows\System32\rp_rules.dat 2013-08-20 02:39 - 2013-08-20 02:39 - 01038995 _____ C:\Users\Dator\AppData\Roaming\2433f433 2013-08-20 02:39 - 2013-08-20 02:39 - 01038976 _____ C:\ProgramData\2433f433 2013-08-20 02:39 - 2013-08-20 02:39 - 01038961 _____ C:\Users\Dator\Local Settings\Application Data\2433f433 2013-08-20 02:39 - 2013-08-20 02:39 - 01038961 _____ C:\Users\Dator\AppData\Local\2433f433 2013-08-20 02:36 - 2011-11-23 10:21 - 00000000 ____D C:\ProgramData\GameXN 2013-08-20 01:38 - 2012-05-08 01:13 - 00000423 _____ C:\Users\Dator\Desktop\Xerox Portal.website 2013-08-19 22:58 - 2011-05-29 07:53 - 00000000 ____D C:\Users\Dator\AppData\Roaming\go 2013-08-19 22:58 - 2008-06-15 03:40 - 00000000 ____D C:\Users\Dator\AppData\Roaming\Skype 2013-08-18 03:24 - 2013-08-18 03:24 - 00016091 _____ C:\Users\Dator\Desktop\hs_err_pid6952.log 2013-08-17 22:00 - 2013-08-17 22:00 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{CEEB70B2-5597-42A4-A0CF-BCF9CAA4160F} 2013-08-17 22:00 - 2013-08-17 22:00 - 00000000 ____D C:\Users\Dator\AppData\Local\{CEEB70B2-5597-42A4-A0CF-BCF9CAA4160F} 2013-08-17 21:59 - 2009-04-03 07:23 - 00000000 ____D C:\Users\Dator\Tracing 2013-08-17 05:18 - 2008-06-04 02:33 - 00045170 _____ C:\Users\Dator\AppData\Roaming\wklnhst.dat 2013-08-17 05:05 - 2009-04-16 22:28 - 00000000 ____D C:\Users\Dator\Documents\Mina skanningar 2013-08-17 05:02 - 2013-08-17 05:01 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{E409EE84-B070-4599-823B-CE07743C08EB} 2013-08-17 05:02 - 2013-08-17 05:01 - 00000000 ____D C:\Users\Dator\AppData\Local\{E409EE84-B070-4599-823B-CE07743C08EB} 2013-08-17 04:55 - 2008-06-04 09:37 - 00049664 _____ C:\Users\Dator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-08-17 04:55 - 2008-06-04 09:37 - 00049664 _____ C:\Users\Dator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-08-16 21:20 - 2011-06-20 23:20 - 10000023 _____ C:\ATsvcLog.txt.old 2013-08-16 17:14 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Microsoft.NET 2013-08-16 17:07 - 2007-12-11 05:15 - 00611620 _____ C:\Windows\System32\perfh01D.dat 2013-08-16 17:07 - 2007-12-11 05:15 - 00123186 _____ C:\Windows\System32\perfc01D.dat 2013-08-16 17:07 - 2006-11-02 02:33 - 01457454 _____ C:\Windows\System32\PerfStringBackup.INI 2013-08-16 17:01 - 2013-08-16 17:01 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{797D8E19-CB93-4080-A9B4-4F2FB541AAF3} 2013-08-16 17:01 - 2013-08-16 17:01 - 00000000 ____D C:\Users\Dator\AppData\Local\{797D8E19-CB93-4080-A9B4-4F2FB541AAF3} 2013-08-15 17:57 - 2013-08-15 17:57 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{0427F92F-CFF5-4E7B-8D1E-B3728F4AE33B} 2013-08-15 17:57 - 2013-08-15 17:57 - 00000000 ____D C:\Users\Dator\AppData\Local\{0427F92F-CFF5-4E7B-8D1E-B3728F4AE33B} 2013-08-15 17:49 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\sv-SE 2013-08-14 17:48 - 2013-08-14 17:48 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{71BC6B42-C840-464F-A1DD-FB7FBB648D6B} 2013-08-14 17:48 - 2013-08-14 17:48 - 00000000 ____D C:\Users\Dator\AppData\Local\{71BC6B42-C840-464F-A1DD-FB7FBB648D6B} 2013-08-14 17:21 - 2013-08-14 17:16 - 00000000 ____D C:\Windows\System32\MRT 2013-08-14 17:16 - 2006-11-02 02:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\System32\mrt.exe 2013-08-07 04:40 - 2008-06-24 01:28 - 00000000 ____D C:\Users\Dator\Documents\Nya ID 2013-08-05 03:30 - 2008-12-09 02:06 - 00000000 ____D C:\Users\Dator\Documents\Mina dokument 2013-08-05 03:18 - 2008-06-04 00:37 - 00017769 _____ C:\ProgramData\hpzinstall.log 2013-08-05 03:03 - 2008-06-04 00:37 - 00138843 _____ C:\Windows\hpoins18.dat 2013-08-05 01:33 - 2013-08-05 01:33 - 00000000 ____T C:\Users\Dator\Documents\10.0.0.2 2013-08-05 01:17 - 2008-06-04 01:17 - 00000000 ____D C:\Users\Dator\AppData\Roaming\Image Zone Express 2013-08-04 21:40 - 2013-08-04 21:40 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{31B6C25D-C2DC-4F87-83A7-30B6B30E67C5} 2013-08-04 21:40 - 2013-08-04 21:40 - 00000000 ____D C:\Users\Dator\AppData\Local\{31B6C25D-C2DC-4F87-83A7-30B6B30E67C5} 2013-08-04 05:57 - 2013-08-04 05:57 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{B6442200-398E-438E-9F6C-C8E760FE8265} 2013-08-04 05:57 - 2013-08-04 05:57 - 00000000 ____D C:\Users\Dator\AppData\Local\{B6442200-398E-438E-9F6C-C8E760FE8265} 2013-07-31 23:05 - 2013-07-31 23:05 - 00000000 ____D C:\Users\Public\Documents\CrashDump 2013-07-31 23:05 - 2013-07-31 23:05 - 00000000 ____D C:\ProgramData\Documents\CrashDump 2013-07-31 23:01 - 2013-07-31 23:01 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log 2013-07-31 23:01 - 2013-07-31 23:01 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\Samsung 2013-07-31 23:01 - 2013-07-31 23:01 - 00000000 ____D C:\Users\Dator\AppData\Local\Samsung 2013-07-31 23:01 - 2013-07-31 23:01 - 00000000 ____D C:\ProgramData\Documents\NativeFus_Log 2013-07-31 23:01 - 2008-08-29 07:27 - 00000000 ____D C:\Users\Dator\AppData\Roaming\Samsung 2013-07-31 22:56 - 2013-07-31 22:56 - 00001783 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk 2013-07-31 22:56 - 2013-07-31 22:56 - 00001783 _____ C:\ProgramData\Desktop\Samsung Kies (Lite).lnk 2013-07-31 22:56 - 2013-07-31 22:56 - 00001773 _____ C:\Users\Public\Desktop\Samsung Kies.lnk 2013-07-31 22:56 - 2013-07-31 22:56 - 00001773 _____ C:\ProgramData\Desktop\Samsung Kies.lnk 2013-07-31 22:56 - 2013-07-31 22:56 - 00000000 ____D C:\Users\Dator\Documents\samsung 2013-07-31 22:53 - 2006-11-02 04:52 - 00068246 _____ C:\Windows\setupact.log 2013-07-31 22:52 - 2008-06-03 12:36 - 00000000 ____D C:\users\Dator 2013-07-31 22:50 - 2008-07-13 02:46 - 00000000 ____D C:\Program Files\Samsung 2013-07-31 22:49 - 2013-07-31 22:29 - 00000000 ____D C:\ProgramData\Samsung 2013-07-31 22:48 - 2013-07-31 22:48 - 00000000 ____D C:\Program Files\MyFree Codec 2013-07-31 22:33 - 2007-12-11 05:43 - 00000000 ___HD C:\Program Files\InstallShield Installation Information 2013-07-31 22:25 - 2009-05-17 09:55 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\Downloaded Installations 2013-07-31 22:25 - 2009-05-17 09:55 - 00000000 ____D C:\Users\Dator\AppData\Local\Downloaded Installations 2013-07-31 21:54 - 2013-07-31 21:54 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{FA69375D-8775-41B6-AE2C-712AE8A9CF81} 2013-07-31 21:54 - 2013-07-31 21:54 - 00000000 ____D C:\Users\Dator\AppData\Local\{FA69375D-8775-41B6-AE2C-712AE8A9CF81} 2013-07-30 00:38 - 2010-12-30 01:14 - 00000000 ____D C:\Users\Dator\AppData\Roaming\Personal 2013-07-29 23:34 - 2012-04-30 04:00 - 00000000 ____D C:\Users\Dator\AppData\Roaming\Intelli-studio 2013-07-29 01:28 - 2010-11-10 01:51 - 00000000 ____D C:\ProgramData\McAfee Security Scan 2013-07-29 01:28 - 2008-11-30 23:41 - 00000000 ____D C:\ProgramData\HP Product Assistant 2013-07-29 01:28 - 2008-06-04 03:49 - 00000000 ____D C:\Users\Dator\AppData\Roaming\iid 2013-07-29 01:28 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\spool 2013-07-29 01:28 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\Msdtc 2013-07-29 01:28 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\registration 2013-07-29 01:28 - 2006-11-02 02:22 - 53477376 _____ C:\Windows\System32\config\software_previous 2013-07-29 01:28 - 2006-11-02 02:22 - 18612224 _____ C:\Windows\System32\config\system_previous 2013-07-29 01:19 - 2006-11-02 02:22 - 41943040 _____ C:\Windows\System32\config\components_previous 2013-07-29 01:19 - 2006-11-02 02:22 - 00053248 _____ C:\Windows\System32\config\sam_previous 2013-07-29 01:14 - 2006-11-02 02:22 - 00524288 _____ C:\Windows\System32\config\default_previous 2013-07-29 01:14 - 2006-11-02 02:22 - 00262144 _____ C:\Windows\System32\config\security_previous 2013-07-28 00:14 - 2013-07-28 00:14 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{4B06ED7B-0BA6-4491-A8EC-7D712817CDB4} 2013-07-28 00:14 - 2013-07-28 00:14 - 00000000 ____D C:\Users\Dator\AppData\Local\{4B06ED7B-0BA6-4491-A8EC-7D712817CDB4} 2013-07-27 03:40 - 2013-07-27 03:40 - 00000000 ____D C:\Users\Dator\Local Settings\Application Data\{5209729A-E0B2-4240-9A23-E6A52B97AC9A} 2013-07-27 03:40 - 2013-07-27 03:40 - 00000000 ____D C:\Users\Dator\AppData\Local\{5209729A-E0B2-4240-9A23-E6A52B97AC9A} 2013-07-24 18:40 - 2013-08-15 17:10 - 12334080 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-07-24 18:32 - 2013-08-15 17:10 - 01800704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-07-24 18:30 - 2013-08-15 17:10 - 09738752 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-07-24 18:26 - 2013-08-15 17:10 - 01129472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-07-24 18:26 - 2013-08-15 17:10 - 01104384 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-07-24 18:25 - 2013-08-15 17:10 - 01427968 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-07-24 18:24 - 2013-08-15 17:10 - 00231936 _____ (Microsoft Corporation) C:\Windows\System32\url.dll 2013-07-24 18:24 - 2013-08-15 17:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-07-24 18:23 - 2013-08-15 17:10 - 01796096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-07-24 18:23 - 2013-08-15 17:10 - 00717824 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-07-24 18:23 - 2013-08-15 17:10 - 00607744 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-07-24 18:23 - 2013-08-15 17:10 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-07-24 18:23 - 2013-08-15 17:10 - 00142848 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-07-24 18:22 - 2013-08-15 17:10 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-07-24 18:22 - 2013-08-15 17:10 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-07-24 18:22 - 2013-08-15 17:10 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
ZeroAccess: C:\Users\Dator\AppData\Local\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}
Files to move or delete: ==================== C:\Users\Dator\AppData\Local\Temp\doxnnyqrlofmrotrs.exe C:\ProgramData\dsgsdgdsgdsgw.pad
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-08-05 00:23:32 Restore point made on: 2013-08-08 23:51:50 Restore point made on: 2013-08-12 00:36:46 Restore point made on: 2013-08-14 17:02:55 Restore point made on: 2013-08-15 17:00:44 Restore point made on: 2013-08-16 17:02:42 Restore point made on: 2013-08-20 05:23:53
==================== Memory info ===========================
Percentage of memory in use: 24% Total physical RAM: 2037.4 MB Available physical RAM: 1538.07 MB Total Pagefile: 1788.11 MB Available Pagefile: 1610.7 MB Total Virtual: 2047.88 MB Available Virtual: 1968.21 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:139.61 GB) (Free:48.24 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (HP_RECOVERY) (Fixed) (Total:9.44 GB) (Free:2.94 GB) NTFS ==>[system with boot components (obtained from reading drive)] Drive f: () (Removable) (Total:0.98 GB) (Free:0.97 GB) FAT Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
======================================================== Disk: 0 (Size: 149 GB) (Disk ID: FAA5FAA5) Partition 1: (Active) - (Size=140 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=9 GB) - (Type=07 NTFS)
======================================================== Disk: 1 (Size: 1000 MB) (Disk ID: 69737369) No partition Table on disk 1.
LastRegBack: 2013-08-20 23:51
==================== End Of Log ========
